Research by CheckPoint presents a new and improved infection chain leading to the deployment of a new version of a Windows backdoor called PowerLess. Credit: ChakisAtelier / Getty Images / Clker-Free-Vector-Images Iranian state-sponsored threat actor Educated Manticore has been observed deploying an updated version of PowerLess, a Windows backdoor, to target Israel for phishing attacks, according to a new report by Check Point.Researchers have also linked Educated Maticore hackers to the Phosphorus APT group, which operates in the Middle East and North America.“The research presents a new and improved infection chain leading to the deployment of a new version of PowerLess. This implant was attributed to Phosphorus in the past,” Check Point said in its research.Phosphorus has been active since at least 2017. It has been linked to a series of campaigns in recent years, especially those wherein APT members posed as journalists and scholars to trick targets into installing malware and stealing classified information. While the PowerLess payload was similar to that deployed by Phosphorus, researchers said there have been improved toolsets used as loading methods.Educated Manticore uses .Net executablesEducated Manticore in its latest attacks was seen using .Net executables, a rarely used technique. “The actor has significantly improved its toolset, utilizing rarely seen techniques, most prominently using .Net executables constructed as Mixed Mode Assembly – a mixture of .Net and native C++ code. It improves tools’ functionality and makes the analysis of the tools to be more difficult,” Check Point said in its report.The hacking group has also started using ISO images. The ISO images used by the threat actor are in English, Arabic, and Hebrew, with academic content about Iraq. Researchers said this suggests, “the targets might have been academic researchers.”The attack chain uses Iraq-themed luresThe attack chain begins with an ISO image file that makes use of Iraq-themed lures to load a custom in-memory downloader.The ISO file claims that the academic information is from a nonprofit organization called the Arab Science and Technology Foundation. The ultimate function of the downloader is to install the PowerLess payload. “PowerLess communication to the server is Base64-encoded and encrypted after obtaining a key from the server. To mislead researchers, the threat actor actively adds three random letters at the beginning of the encoded blob,” Check Point said in its report.The use of the PowerLess payload by Phosphorus was highlighted by Cybereason in February 2022. The PowerLess payload has the capability to steal data from web browsers and apps like Telegram, take screenshots, record audio, and log keystrokes. Expect more post-infection activityResearchers have warned that the updated version of the malware can lead to more post-infection activities.“Because it is an updated version of previously reported malware, PowerLess, associated with some of Phosphorus’ Ransomware operations, it is important to note that it might only represent the early stages of infection, with significant fractions of post-infection activity yet to be seen in the wild,” Check Point said.Educated Manticore continues to evolve, refining previously observed toolsets and delivering mechanisms, Check Point said. “The actor is seen adopting popular trends to avoid detection and keeps developing custom toolsets using advanced techniques,” Check Point said in its report. Related content news UK government plans 2,500 new tech recruits by 2025 with focus on cybersecurity New apprenticeships and talent programmes will support recruitment for in-demand roles such as cybersecurity technologists and software developers By Michael Hill Sep 29, 2023 4 mins Education Industry Education Industry Education Industry news UK data regulator orders end to spreadsheet FOI requests after serious data breaches The Information Commissioner’s Office says alternative approaches should be used to publish freedom of information data to mitigate risks to personal information By Michael Hill Sep 29, 2023 3 mins Government Cybercrime Data and Information Security feature Cybersecurity startups to watch for in 2023 These startups are jumping in where most established security vendors have yet to go. By CSO Staff Sep 29, 2023 19 mins CSO and CISO Security news analysis Companies are already feeling the pressure from upcoming US SEC cyber rules New Securities and Exchange Commission cyber incident reporting rules don't kick in until December, but experts say they highlight the need for greater collaboration between CISOs and the C-suite By Cynthia Brumfield Sep 28, 2023 6 mins Regulation Data Breach Financial Services Industry Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe